wannacry | a68dbf03faf318b6b4c599e2b9d3da00703b2668c5dc22f3262a3effdc38f580

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2022 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5f5f4b69903ead601696df4279fcfb5.dll
Size

5.0MB
MD5

f5f5f4b69903ead601696df4279fcfb5
SHA1

c20ccce59868c3b7bc5c2e291740b1b6659f95ed
SHA256

a68dbf03faf318b6b4c599e2b9d3da00703b2668c5dc22f3262a3effdc38f580
SHA512

73aa9f8005f36caeed4cf4490bb38a2b7d10a0755f05ee01c127dad3bf37fd1dc594c7ca8908e5fe6d62d27a5db7f166c0d1249d979c6bc3c114867f3ddb87ee

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3201) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

5064 mssecsvc.exe
4264 mssecsvc.exe
4272 tasksche.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

pid	process
5064	mssecsvc.exe
4264	mssecsvc.exe
4272	tasksche.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 5100 wrote to memory of 3976	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 3976	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 3976	5100	rundll32.exe	rundll32.exe
PID 3976 wrote to memory of 5064	3976	rundll32.exe	mssecsvc.exe
PID 3976 wrote to memory of 5064	3976	rundll32.exe	mssecsvc.exe
PID 3976 wrote to memory of 5064	3976	rundll32.exe	mssecsvc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5f5f4b69903ead601696df4279fcfb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f5f5f4b69903ead601696df4279fcfb5.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3976

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5064

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:4272

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\mssecsvc.exe
Filesize
3.6MB

MD5
4a3bc8abfb61a51046c5d57ccdb3c971

SHA1
3fab0b3c32c65658a5294bae711186f590593a79

SHA256
d7f2e2a8ed20acabcf425d450e299d572711b96b79dd1d845e7b5277148e4147

SHA512
f371c5b47b64ac145863dc351bd4be493922aca787067c52dd3620be3660597c1d0646a55d46eab7861f178fe80664f543301bc99deda7969737fc65e2d43967

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
4a3bc8abfb61a51046c5d57ccdb3c971

SHA1
3fab0b3c32c65658a5294bae711186f590593a79

SHA256
d7f2e2a8ed20acabcf425d450e299d572711b96b79dd1d845e7b5277148e4147

SHA512
f371c5b47b64ac145863dc351bd4be493922aca787067c52dd3620be3660597c1d0646a55d46eab7861f178fe80664f543301bc99deda7969737fc65e2d43967

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
4a3bc8abfb61a51046c5d57ccdb3c971

SHA1
3fab0b3c32c65658a5294bae711186f590593a79

SHA256
d7f2e2a8ed20acabcf425d450e299d572711b96b79dd1d845e7b5277148e4147

SHA512
f371c5b47b64ac145863dc351bd4be493922aca787067c52dd3620be3660597c1d0646a55d46eab7861f178fe80664f543301bc99deda7969737fc65e2d43967

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
1557965033d241c689d83ca84b856e1f

SHA1
d6ee7982ca3ce335995788a31760f2c8e2b73780

SHA256
e026ca34fa4cb8d690c9828c62ef6dc1cead1f2f2f753faacdb0c1b91ac060c5

SHA512
d28bdcc31fe6e8f5548a8a3611ff80c747bf5d52f22ea25695af5abd9a44e92471581b6d249280a51005a3eb053959ff317732956db5ae172658714f9c841687

Download Submit
memory/3976-133-0x0000000000000000-mapping.dmp

Download
memory/5064-134-0x0000000000000000-mapping.dmp

Download